Cross-application sandbox penetration protection system and method based on hardware assistance

Abstract

The invention provides a cross-application sandbox penetration protection system and method based on hardware assistance, and belongs to the technical field of mobile terminal security. The method comprises the following steps: S1, acquiring a memory access sequence of a process in real time through a memory tag extension module, and acquiring permission combination and inter-process communication data through a kernel interface; s2, calculating a deviation value between the permission combination and the white list based on cosine similarity, and quantifying a state transition abnormal probability of the memory access sequence by using a Markov chain algorithm; s3, performing feature fusion on an output result of the step S2 and inter-process communication data, and inputting a long-short-term memory network model to generate a comprehensive risk score; when the score exceeds a threshold, the dynamic policy arbitration module is triggered to perform a hierarchical response action. The method has higher recognition rate and interception rate.

Description

Technical Field

[0001] The present invention belongs to the field of mobile terminal security technology, and in particular relates to a hardware-assisted cross-application sandbox penetration protection system and method. Background Art

[0002] In recent years, network security issues have become increasingly prominent, with hacker intrusions and cyberattacks on the rise. A full sandbox is an execution environment that restricts program behavior according to security policies. However, traditional sandbox mechanisms rely on Linux kernel namespace isolation and are unable to protect against covert channel attacks targeting legitimate system services (such as Binder IPC). Summary of the Invention

[0003] In response to the above technical problems, the present invention proposes a hardware-assisted cross-application sandbox penetration protection system and method.

[0004] A first aspect of the present invention discloses a hardware-assisted cross-application sandbox penetration protection method, the method comprising: Step S1: collect the memory access sequence of the process in real time through the memory tag extension module, and collect the permission combination and inter-process communication data through the kernel interface; Step S2: Calculate the deviation between the permission combination and the whitelist based on cosine similarity, and use the Markov chain algorithm to quantify the abnormal probability of state transition of the memory access sequence; In step S3, the deviation value, abnormal probability of state transition and inter-process communication data are integrated into the feature fusion and input into the long short-term memory network model to generate a comprehensive risk score. When the score exceeds the threshold, the dynamic policy arbitration module is triggered to execute a graded response action.

[0005] Optionally, in step S1, the memory access sequence includes: a timestamp, a process ID, a memory address, an access type, and a tag.

[0006] Optionally, in step S1, the permission combination data is obtained by one of the following methods: Access control lists provided by the kernel layer access control module; An open, read, or setuid operation captured by the system call tracing interface; or The resource permission monitoring module provides system resource permission request records.

[0007] Optionally, in step S1, the inter-process communication data includes inter-process communication frequency, target object and data volume time series change characteristics.

[0008] Optionally, in step S3, the hierarchical response actions include: At the first risk level: log and issue an alarm; At the second risk level: restrict process permissions or isolate memory areas; At the third risk level: terminate the process and block related system calls; Among them, the first risk level is lower than the second risk level, and the second risk level is lower than the third risk level.

[0009] Optionally, step S1 further includes: injecting random noise into the collected inter-process communication data.

[0010] A second aspect of the present invention discloses a hardware-assisted cross-application sandbox penetration protection system, the system comprising: The first processing module is configured to collect the memory access sequence of the process in real time through the memory tag extension module, and collect the permission combination and inter-process communication data through the kernel interface; The second processing module is configured to calculate the deviation value between the permission combination and the whitelist based on cosine similarity, and quantify the state transition abnormality probability of the memory access sequence using a Markov chain algorithm; The third processing module is configured to perform feature fusion on the deviation value, the abnormal probability of state transition and the inter-process communication data, and input the feature into the long short-term memory network model to generate a comprehensive risk score; The fourth processing module is configured to dynamically trigger the dynamic policy arbitration module to execute a graded response action according to the comprehensive risk score.

[0011] A third aspect of the present invention discloses an electronic device comprising a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the hardware-assisted cross-application sandbox penetration protection method described in the first aspect of the present invention.

[0012] A fourth aspect of the present invention discloses a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the hardware-assisted cross-application sandbox penetration protection method described in the first aspect of the present invention.

[0013] In summary, the solution proposed in this invention has the following technical effects: the cross-application protection system combining hardware security modules with dynamic behavior analysis has higher recognition and interception rates. It can provide better protection for applications with high security requirements (such as financial applications). Specifically: Integration of software and hardware: The Memory Tag Extension (MTE) module is hardware monitoring, and the Long Short-Term Memory (LSTM) model deployed in the Trusted Execution Environment (TEE) module is software intelligent analysis. The two work together to improve security.

[0014] No fear of system hacking: Even if the system is controlled by malicious programs, TEE can independently judge and prevent it due to its independence. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0016] Figure 1 This is a flow chart of a hardware-assisted cross-application sandbox penetration protection method according to an embodiment of the present invention; Figure 2 This is a structural diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0017] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0018] The first aspect of the present invention discloses a cross-application sandbox penetration protection method based on hardware assistance, which implements boundary reinforcement through a three-layer protection architecture. Figure 1 , which combines a multi-level security protection system at the software and hardware levels, aims to detect and block malicious attacks through the collaborative work of the user layer, kernel layer and hardware layer, especially threats to inter-process communication (IPC) and memory security.

[0019] The method comprises: S1, collects the memory access sequence of the process in real time through the Memory Tag Extension (MTE) module, and collects the permission combination and inter-process communication data through the kernel interface; Optionally, the memory tag expansion module is a memory controller with the following functions: Tag assignment: Assign security tags to memory to ensure that only authorized processes can access specific memory areas.

[0020] Memory access behavior monitoring sensor: Provides recorded data.

[0021] Hardware exception triggering: The access rights of the initiating process are verified through the MTE memory tag. If the tags do not match, a hardware exception is triggered. For example, when an illegal memory access (such as a buffer overflow or use-after-free vulnerability) is detected, a hardware-level exception is directly triggered to terminate the attack.

[0022] To enhance the ability to trigger hardware anomalies, the application sandbox key is dynamically bound to the device PUF response value and the geographic location hash. The key update equation is: K_new = HMAC(K_old, PUF⊕Geohash(GPS)); Where K_new is the updated key; HMAC is a hash-based pseudorandom function; K_old is the key before the update; PUF is the response value of the physically unclonable function; ⊕ is the XOR symbol; and Geohash(GPS) is the hash value of the geocoded string, which is the output of the Geohash algorithm (e.g., 12-character precision) of the device's current GPS coordinates (latitude and longitude), compressed using a cryptographic hash (e.g., SHA-256).

[0023] In step S1 , the memory access sequence includes: timestamp, process ID, memory address, access type and tag.

[0024] Specifically, the tag records accessed through the MTE memory output information such as time, process ID, memory address, type, tag, and module. These information is collected by the TEE process into feature vectors for use in LSTM time series analysis and Markov chain state judgment.

[0025] Optionally, in step S1, the permission combination data is obtained in the following manner: Access control lists provided by the kernel layer access control module; An open, read, or setuid operation captured by the system call tracing interface; or The resource permission monitoring module provides system resource permission request records.

[0026] Specifically, permission combination data can be obtained through kernel-level modules such as DAC and MAC. Furthermore, permission combination data can be obtained through system call / API tracking, such as calls to open, read, write, chmod, and setuid. This also includes permissions to read system resources, such as the camera and microphone, and whether access is granted high permissions only to core system apps. For example, an app attempting to read data under / system / is considered a high-risk operation.

[0027] Optionally, in step S1, the inter-process communication data (ie, IPC communication data) includes inter-process communication frequency, target objects, and temporal variation characteristics of data volume.

[0028] IPC communication data can be obtained through the framework layer and the kernel layer, and information such as the number of IPC requests, objects, and transferred data size within the sliding window are output.

[0029] Optionally, step S1 also includes injecting random noise into the collected inter-process communication data. This step effectively destabilizes adversarial examples through a three-layer defense system consisting of noise injection, semantic verification, and kernel protection. Optionally, the noise intensity is adjusted based on parameter type and historical behavior.

[0030] S2, calculates the deviation between the permission combination and the whitelist based on cosine similarity, and uses the Markov chain algorithm to quantify the abnormal probability of state transition of the memory access sequence; Markov chain: This algorithm is used to determine whether the memory access path conforms to normal behavior and outputs quantitative data. Cosine similarity: This algorithm is used to output whether the permission combination is normal and outputs quantitative data.

[0031] Markov chains and cosine similarity are pre-analyzers, acting as local feature extractors. The output data or scores serve as part of the LSTM input features. See Table 1 for the detection methods corresponding to each risk factor.

[0032]

[0033] S3, the output result of step S2 is integrated with the inter-process communication data, and the results are input into the long short-term memory network model to generate a comprehensive risk score. When the score exceeds the threshold, the dynamic policy arbitration module is triggered to execute a graded response action.

[0034] Optionally, in step S3, the hierarchical response actions include: At the first risk level (low risk): log and issue an alarm; At the second risk level (medium risk): restrict process permissions or isolate memory areas; At the third risk level (high risk): terminate the process and block related system calls.

[0035] Examples of dynamic strategy effects: Normal behavior: open the image (permissions and memory access) - process the image (memory access) - save the image to the album (permissions + memory access + IPC communication) --> pass.

[0036] Abnormal behavior example 1: Opening an image (permissions and memory access) - Attempting to access an illegal address not belonging to this program (memory access) - Changing the UID (permissions) --> Alarm.

[0037] The proposed solution has the following technical benefits: The cross-application protection system, which combines a hardware security module with dynamic behavior analysis, has higher recognition and interception rates. This provides enhanced protection for applications with high security requirements, such as financial applications.

[0038] A second aspect of the present invention discloses a hardware-assisted cross-application sandbox penetration protection system, the system comprising: The first processing module is configured to collect the memory access sequence of the process in real time through the memory tag extension module, and collect the permission combination and inter-process communication data through the kernel interface; Optionally, the memory tag expansion module is a memory controller with the following functions: Tag assignment: Assign security tags to memory to ensure that only authorized processes can access specific memory areas.

[0039] Hardware exception triggering: The access rights of the initiating process are verified through the MTE memory tag. If the tags do not match, a hardware exception is triggered. For example, when an illegal memory access (such as a buffer overflow or use-after-free vulnerability) is detected, a hardware-level exception is directly triggered to terminate the attack.

[0040] To enhance the ability to trigger hardware anomalies, the application sandbox key is dynamically bound to the device PUF response value and the geographic location hash. The key update equation is: K_new = HMAC(K_old, PUF⊕Geohash(GPS)).

[0041] The memory access sequence includes: timestamp, process ID, memory address, access type and label.

[0042] Specifically, the tag records accessed through the MTE memory output information such as time, process ID, memory address, type, tag, and module. These information is collected by the TEE process into feature vectors for use in LSTM time series analysis and Markov chain state judgment.

[0043] Optionally, the permission combination data is obtained in the following ways: Access control lists provided by the kernel layer access control module; open, read, or setuid operations captured by the system call tracing interface; and The resource permission monitoring module provides system resource permission request records.

[0044] Specifically, permission combination data can be obtained through kernel-level modules such as DAC and MAC. Furthermore, permission combination data can be obtained through system call / API tracking, such as calls to open, read, write, chmod, and setuid. This also includes permissions to read system resources, such as the camera and microphone, and whether access is granted high permissions only to core system apps. For example, an app attempting to read data under / system / is considered a high-risk operation.

[0045] Optionally, the inter-process communication data (i.e., IPC communication data) includes inter-process communication frequency, target objects, and temporal change characteristics of data volume.

[0046] IPC communication data can be obtained through the framework layer and the kernel layer, and information such as the number of IPC requests, objects, and transferred data size within the sliding window are output.

[0047] Optionally, the first processing module is further configured to inject random noise into the collected inter-process communication data. This step effectively destabilizes adversarial examples through a three-layer defense system consisting of noise injection, semantic verification, and kernel protection. Optionally, the noise intensity is adjusted based on parameter type and historical behavior.

[0048] The second processing module is configured to calculate the deviation between the permission combination and the whitelist based on cosine similarity and quantify the probability of abnormal state transitions in the memory access sequence using a Markov chain algorithm. The Markov chain algorithm is used to determine whether the memory access path conforms to normal behavior and outputs quantitative data. The cosine similarity algorithm is used to output whether the permission combination is normal and outputs quantitative data.

[0049] Markov chain and cosine similarity are pre-analyzers, used as local feature extraction, and output data or scores as part of LSTM input features.

[0050] A third processing module is configured to perform feature fusion on the output result of the second processing module and the inter-process communication data, and input the feature fusion into the long short-term memory network model to generate a comprehensive risk score; The long short-term memory network model is deployed in the trusted execution environment module (TEE), receiving memory access sequences, system permission combination data, and inter-process communication (IPC) data to perform multi-dimensional risk assessment.

[0051] The fourth processing module is configured to dynamically trigger the dynamic policy arbitration module to execute a graded response action according to the comprehensive risk score.

[0052] Tiered response actions include: At the first risk level: log and issue an alarm; At the second risk level: restrict process permissions or isolate memory areas; At the third risk level: terminate the process and block related system calls.

[0053] A third aspect of the present invention discloses an electronic device comprising a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the hardware-assisted cross-application sandbox penetration protection method described in the first aspect of the present invention.

[0054] Figure 2 FIG. 1 is a structural diagram of an electronic device according to an embodiment of the present invention. Figure 2 As shown, the electronic device includes a processor, memory, a communication interface, a display, and an input device connected via a system bus. The processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The communication interface of the electronic device is used to communicate with an external terminal via wired or wireless communication. The wireless communication method can be achieved through Wi-Fi, a carrier network, near-field communication (NFC), or other technologies. The display of the electronic device can be a liquid crystal display or an electronic ink display. The input device of the electronic device can be a touch layer covering the display, or it can be buttons, a trackball, or a touchpad provided on the electronic device housing, or it can be an external keyboard, touchpad, or mouse.

[0055] Those skilled in the art will understand that Figure 2 The structure shown in the figure is only a structural diagram of the part related to the technical solution of the present disclosure, and does not constitute a limitation on the electronic device to which the solution of the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0056] A fourth aspect of the present invention discloses a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the hardware-assisted cross-application sandbox penetration protection method described in the first aspect of the present invention.

[0057] The above embodiments are intended only to illustrate the technical solutions of the present invention and are not intended to limit the same. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that the technical solutions described in the above embodiments may be modified or some or all of the technical features thereof may be replaced with equivalents, and such modifications or replacements do not deviate from the essence of the corresponding technical solutions within the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A cross-application sandbox penetration protection method based on hardware assistance, characterized in that: The method comprises: Step S1: collect the memory access sequence of the process in real time through the memory tag extension module, and collect the permission combination and inter-process communication data through the kernel interface; Step S2: Calculate the deviation between the permission combination and the whitelist based on cosine similarity, and use the Markov chain algorithm to quantify the abnormal probability of state transition of the memory access sequence; In step S3, the deviation value, abnormal probability of state transition and inter-process communication data are integrated into the feature fusion and input into the long short-term memory network model to generate a comprehensive risk score. When the score exceeds the threshold, the dynamic policy arbitration module is triggered to execute a graded response action.

2. The method according to claim 1, characterized in that In step S1 , the memory access sequence includes: timestamp, process ID, memory address, access type and tag.

3. The method according to claim 1, characterized in that In step S1, the permission combination is obtained in one of the following ways: Access control lists provided by the kernel layer access control module; An open, read, or setuid operation captured by the system call tracing interface; or The resource permission monitoring module provides system resource permission request records.

4. The method according to claim 1, wherein In step S1, the inter-process communication data includes the inter-process communication frequency, target object and data volume time series change characteristics.

5. The method according to claim 1, wherein In step S3, the hierarchical response actions include: At the first risk level: log and issue an alarm; At the second risk level: restrict process permissions or isolate memory areas; At the third risk level: terminate the process and block related system calls; Among them, the first risk level is lower than the second risk level, and the second risk level is lower than the third risk level.

6. The method according to any one of claims 1 to 5, characterized in that Step S1 also includes: injecting random noise into the collected inter-process communication data.

7. A hardware-assisted cross-application sandbox penetration protection system, characterized in that: The system comprises: The first processing module is configured to collect the memory access sequence of the process in real time through the memory tag extension module, and collect the permission combination and inter-process communication data through the kernel interface; The second processing module is configured to calculate the deviation value between the permission combination and the whitelist based on cosine similarity, and quantify the state transition abnormality probability of the memory access sequence using a Markov chain algorithm; The third processing module is configured to perform feature fusion on the deviation value, the abnormal probability of state transition and the inter-process communication data, and input the feature into the long short-term memory network model to generate a comprehensive risk score; The fourth processing module is configured to dynamically trigger the dynamic policy arbitration module to execute a graded response action according to the comprehensive risk score.

8. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, it implements the steps of a hardware-assisted cross-application sandbox penetration protection method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, the steps of the hardware-assisted cross-application sandbox penetration protection method according to any one of claims 1 to 6 are implemented.

Images